Random word generator

Passwords are a horrible user experience. They’re hard to come up with, hard to remember, and—when created how almost everyone creates them—provide almost zero security benefit. Unfortunately, there’s also no way around them.

In general, I recommend using a password manager for every password you possibly can. Password managers are the most prolific member of a set of rare tools that make your life both easier and more secure. However, a password manager doesn’t always fit the bill. Sometimes, passwords have to be accessed somewhere the password manager can’t easily reach: on an unsupported device, inside a protected corporate network, or for your password manager itself, for example. For special cases like these, I recommend using a pass“phrase” instead of a pass“word”. Short, randomly generated phrases of 4–5 words are easier to remember than convoluted 16-character portmanteaus, and tend to make more secure passwords anyway. Come up with your own system for mixing in numbers or special characters, as required—that part isn’t very important, if you’re using this system.

When creating passphrases, it is important to make sure your words are randomly generated from a large list, otherwise your password might be guessed quickly. I have a background in encryption, and I couldn’t find a tool that was up to my standards for this task. So, I made this tool (and I use this tool) to generate passphrases that I use to secure anything I can’t use my password manager for. The words you generate aren’t saved anywhere. It’s open-source, so you can check that, as well as my other claims about it. And, it uses specialized, military-grade hardware to generate words at the absolute highest level of security.

Technical details

The words you generated, if joined into a passphrase as

ComplainantBiasedPlasterersConfrontations

Are as secure as any other 41-digit password.

Even if an attacker (somehow) knows you’ve used this tool to generate your passphrase, it will still be at least as secure as an 11-digit password composed of a typical set of 40 letters, numbers, and special characters.

The tool picks words from a word list of the top 25,000 most frequently used four-or-more-letter words in the English language according to the Google Web Trillion Word Corpus. Some words may be misspelled.

To generate random indices in the word list, the tool uses AWS KMS’s GenerateRandom function. GenerateRandom returns random bits from a hardware security module (a server specialized for cryptographic computations).